Glossary
cluster-admin
The built-in Kubernetes ClusterRole granting every verb on every resource. A new binding to it is one of the strongest signs of cluster compromise.
cluster-admin is a default ClusterRole that allows any action on any resource in the cluster, including secrets, RBAC and workloads in kube-system. Whoever is bound to it controls the cluster.
Attackers who obtain a sufficiently privileged token often create a new service account and a ClusterRoleBinding to cluster-admin, then mint a token for it, so they keep access after the first credential is revoked. In the audit log this is a create on clusterrolebindings whose request body has roleRef.name: cluster-admin. The analyzer rates it critical. See RBAC privilege escalation and the fictional walkthrough.